CVE-2026-18150

The CVSS 5.3 score for this race condition on IBM i obscures a risk profile that generic severity metrics fail to capture. The vulnerability affects IBM i versions 7.3 through 7.6, persisting across four major releases—a strong signal this is an architectural issue rather than an isolated code defect. That persistence matters because IBM i's tight coupling between file systems, database layers, and job subsystems means a race condition enabling information disclosure can expose authentication contexts, session tokens, or cross-service data that gives an attacker pivot capability far exceeding the initial disclosure scope. The authenticated attacker requirement is less constraining than it appears. IBM i-specific attack patterns—green-screen password harvesting, pass-the-hash techniques, compromised service accounts—have been documented and operationalized since at least 2019. Credentials on IBM i often map directly to AS/400 job descriptions, system values, and database authority structures, meaning a single disclosure can capture keys to kingdom-level access. This isn't theoretical; it's a documented exploitation lineage that chains cleanly with the vulnerability. Worse, the persistence across 7.3 through 7.6 suggests institutional acclimatization. Organizations running IBM i for a decade have likely built compensating controls or convinced themselves this class of flaw isn't exploitable—neither of which has been validated against an adversary who now has a documented attack path. The CVE publication changes the threat calculus retroactively: before today this was theoretical, after today there's a confirmed target for tooling development. Your priorities: confirm whether your monitoring detects IBM i-specific credential misuse (most EDR and SIEM products have limited visibility here), evaluate whether compensating controls hold under targeted adversarial attention, and account for the compressed disclosure-to-exploit window that applies to regulated infrastructure running IBM i. This is not a patch-and-forget vulnerability.

Reviewed through automated stages and approved by a human before publication.